Privacy
This policy explains which personal data is processed when you visit this website, for which purpose and on which legal basis this happens, and which rights you have as a data subject.
This is a courtesy translation of our German privacy policy. In the event of any discrepancy, the German version (“Datenschutzerklärung”) is authoritative.
The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:
No data protection officer has been appointed, as the statutory conditions requiring such an appointment are not met. For any data protection matter, please contact us directly using the details above.
We process personal data exclusively within the framework of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Personal data means any information relating to an identified or identifiable natural person.
This website is deliberately built around data minimisation. We process only the data required to operate the website and to handle your enquiries. No further evaluation of your usage behaviour takes place.
This website is operated with an external service provider (host). When a page is requested, the web server automatically collects and stores data in so-called server log files, which your browser transmits for technical reasons.
This data is processed on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically faultless, secure and stable operation of the website and in preventing and investigating attacks on our systems. This data is not combined with other data sources and is not evaluated for advertising purposes.
Log files are deleted as soon as they are no longer required for the stated purpose. Where they remain necessary to investigate a specific security-related incident, they are retained until that investigation has been completed.
Insofar as the host processes personal data on our behalf, this takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR concluded with the respective service provider, where such an agreement is legally required. The service provider is bound by our instructions and does not process the data for its own purposes.
For security reasons and to protect the transmission of confidential content, this website uses state-of-the-art transport encryption (SSL/TLS). You can recognise an encrypted connection by the address bar of your browser starting with “https://” and displaying a padlock symbol. When encryption is active, the data you transmit to us cannot readily be read by third parties.
Two forms are available on this website: a general contact form and a form for sourcing and procurement enquiries. Using either form is voluntary; you may also contact us directly by e-mail, phone or fax at any time.
In the contact form we process the details you enter for name, company (optional), e-mail address, phone number (optional), subject and message.
In the sourcing form we process the details you enter for company, name, e-mail address, phone number (optional), product or product type, desired quantity (optional), target market (optional), desired deadline (optional), description and an optional additional message.
The details are checked on our server for completeness and format and are then transmitted by e-mail via encrypted SMTP delivery to our business address info@gramli.eu. The form content is not stored in a database on this website; the data remains in our e-mail mailbox.
Please do not use the forms to send special categories of personal data within the meaning of Art. 9 GDPR, or any access credentials.
Where your enquiry is aimed at concluding or performing a contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases, processing is based on Art. 6(1)(f) GDPR; our legitimate interest lies in responding to business enquiries.
We store the data for as long as it is required to handle your enquiry and any follow-up communication. It is then deleted unless statutory retention obligations apply – in particular commercial and tax law retention periods under the German Commercial Code (HGB) and Fiscal Code (AO). In that case, processing is restricted for the duration of the retention period.
To protect against automated spam submissions, the forms contain an additional field that is invisible to you (a so-called honeypot field) and is only completed by automated programs. In addition, we limit the number of submissions per IP address within a short period of time. For this purpose the IP address is held solely and temporarily in the server's working memory and is discarded automatically once the short time window has elapsed; it is not stored permanently and is not linked to your enquiry.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in preventing misuse and keeping our forms operational. No external captcha service is used.
If you contact us directly by e-mail, phone or fax, we process the data you provide in order to handle your request. The legal basis is Art. 6(1)(b) GDPR where the communication serves the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to business enquiries. The same retention principles apply as for form enquiries.
This website does not set any cookies that require consent. No tracking, marketing or statistics cookies are used, which is why no cookie banner is necessary.
The only item used is an entry in your browser's local storage under the key “gramli-theme”. It stores nothing but the display mode you selected – light mode, dark mode or following your system setting. This entry contains no personal data, does not allow you to be recognised and is not transmitted to our server or to any third party; it remains solely on your device.
This is a purely technical convenience function. You can delete the entry at any time via your browser settings; the website remains fully usable afterwards and returns to following your system setting.
The fonts used on this website are served locally from our own server and are embedded via the font optimisation of the web framework we use. No connection to Google Fonts or any other external font service takes place.
This website embeds no external resources whatsoever: no content delivery networks, no external scripts, no embedded maps, videos or iframes, and no images loaded from third parties. This is additionally enforced technically by a strict Content Security Policy. When you access this website, no connection to third-party servers is therefore established and no IP address is transmitted to third parties.
We would like to state explicitly what this website does not do:
We disclose personal data only where this is necessary for the purposes described. Recipients may be our hosting service provider and the provider of our e-mail mailbox or SMTP delivery, in each case as processors under Art. 28 GDPR where such an agreement is required. Beyond that, we disclose data only where we are legally obliged to do so or where you have consented.
Operating this website does not involve any transfer of personal data to bodies outside the European Union or the European Economic Area. Should a transfer to a third country exceptionally become necessary while handling a specific business enquiry, it will only take place if the requirements of Art. 44 et seq. GDPR are met.
We collect only the data actually required for the respective purpose and store it only for as long as necessary. Mandatory fields in the forms are limited to the minimum we need in order to understand and answer an enquiry; all other fields are optional.
We take technical and organisational measures pursuant to Art. 32 GDPR to protect the data we process against loss, destruction, alteration and unauthorised access. These include, in particular, encrypted transmission, server-side validation of all form input and a limited group of people with access to incoming enquiries.
Under the GDPR you have the following rights against us with regard to personal data concerning you:
Where we process your personal data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to such processing. If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
An informal message to the contact details above is sufficient to exercise your rights. Exercising them is generally free of charge for you.
Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR. Competent authorities include, in particular, a supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.
Providing personal data is neither legally nor contractually required. However, certain details are necessary in order to use the forms; without them we cannot process and answer your enquiry. The technically required processing of server log files cannot be avoided when a website is accessed.
We adapt this privacy policy whenever changes to this website or to the nature of the data processing make it necessary, or when the legal situation changes. The version available on this page applies in each case. Please therefore check the current version before sending an enquiry.